Machine-Learning-Based Feature Selection Techniques for Large-Scale Network Intrusion Detection

Al-Jarrah, Omar Y.; Siddiqui, Amna; ElSalamouny, Malak Y.; Yoo, Paul D.; Kim, Kyoungyoun

doi:10.1109/icdcsw.2014.14

Cited by 69 publications

(35 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…RF-FSR 20 [0,1,34,35,36,37,38,39,42,43,44,45,46,47,16,17,18,19,20,26] RF-BER 16 [0, 1, 16, 17, 18, 19, 20, 26, 35, 37, 39, 42, 43, 44, 45, 47] CS 11 [37, 16, 17,18, 19, 26, 27,42, 44, [6,13,18,27,38,39,47,50,51,57,60,76,82,84,88,92] 1,34,35,36,37,38,39,42,43,44,45,46,47,16,17,18,19,…”

Section: Methods Feature Subset Number Feature Subsetmentioning

confidence: 99%

“…Jarrah et al [18] proposed random forest-forward selection sorting (RF-FSR) and random forest-backward sorting (RF-BER). The experimental results show that the selected features on the KDD-Cup 99 dataset effectively improve their detection rate and reduce the false positive rate, reaching 99.8% and 0.001%, respectively.…”

Section: Feature Selection Comparisonmentioning

confidence: 99%

“…Al Jarrah et al [19] proposed combining the consistent subset evaluation (CSE) and DDoS characteristic features (DCF) techniques in feature selection algorithms to identify and select the most important and relevant features associated with DDoS attacks. This paper compares the RF-FSR algorithm [18], RF-BER algorithm [18], GI (information gain) [15], CS (chi-square test) [15], and CSE [19]. In this paper, different methods are used to select features using the 20k TCP flow dataset and 20k UDP flow dataset.…”

Section: Feature Selection Comparisonmentioning

confidence: 99%

“…RF-FSR 18 [6,13,18,27,38,39,47,50,51,56,57,60,73,76,82,84,88,92] RF-BER 24 [6,13,18,27,38,39,47,50,51,56,57,60,68,73,76,80,82,84,85,88,89,92,98,101] GI 35 [1,12,13,14,39,43,44,45,50,51,59,60,63,64,65,66,67,71,…”

Section: Feature Subset Number Feature Subsetmentioning

confidence: 99%

See 3 more Smart Citations

A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors

et al. 2019

View full text Add to dashboard Cite

In recent years, distributed denial of service (DDoS) attacks have increasingly shown the trend of multiattack vector composites, which has significantly improved the concealment and success rate of DDoS attacks. Therefore, improving the ubiquitous detection capability of DDoS attacks and accurately and quickly identifying DDoS attack traffic play an important role in later attack mitigation. This paper proposes a method to efficiently detect and identify multivector DDoS attacks. The detection algorithm is applicable to known and unknown DDoS attacks.

show abstract

Section: Methods Feature Subset Number Feature Subsetmentioning

confidence: 99%

Section: Feature Selection Comparisonmentioning

confidence: 99%

Section: Feature Selection Comparisonmentioning

confidence: 99%

Section: Feature Subset Number Feature Subsetmentioning

confidence: 99%

See 2 more Smart Citations

A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors

et al. 2019

View full text Add to dashboard Cite

show abstract

“…In 2014, O. Y. Al-Jarrah et al [23], used an ensembles of decision-tree based voting algorithm with forward selection / backward elimination feature raking techniques using a Random Forest Classifier. Their method shows an improvement of detection accuracy when selected important features and it can be suitable for large-scale network.…”

Section: Description Of Nsl-kddmentioning

confidence: 99%

A Subset Feature Elimination Mechanism for Intrusion Detection System

Nkiama¹,

Said²,

Saidu³

2016

ijacsa

View full text Add to dashboard Cite

Abstract-several studies have suggested that by selecting relevant features for intrusion detection system, it is possible to considerably improve the detection accuracy and performance of the detection engine. Nowadays with the emergence of new technologies such as Cloud Computing or Big Data, large amount of network traffic are generated and the intrusion detection system must dynamically collected and analyzed the data produce by the incoming traffic. However in a large dataset not all features contribute to represent the traffic, therefore reducing and selecting a number of adequate features may improve the speed and accuracy of the intrusion detection system. In this study, a feature selection mechanism has been proposed which aims to eliminate non-relevant features as well as identify the features which will contribute to improve the detection rate, based on the score each features have established during the selection process. To achieve that objective, a recursive feature elimination process was employed and associated with a decision tree based classifier and later on, the suitable relevant features were identified. This approach was applied on the NSL-KDD dataset which is an improved version of the previous KDD 1999 Dataset, scikit-learn that is a machine learning library written in python was used in this paper. Using this approach, relevant features were identified inside the dataset and the accuracy rate was improved. These results lend to support the idea that features selection improve significantly the classifier performance. Understanding the factors that help identify relevant features will allow the design of a better intrusion detection system.

show abstract

Real‐time anomaly detection using parallelized intrusion detection architecture for streaming data

Chellammal¹,

D²

2018

Concurrency and Computation

View full text Add to dashboard Cite

SummaryHigh usage levels of networking technologies has resulted in large amounts of data being generated. This in‐turn has lured several fraudsters, whose anomalous behaviors create undesired consequences to legitimate users. This paper proposes an Adaptive Parallelized Intrusion Detection (APID) architecture to handle the hugeness and data imbalance associated with streaming data. The architecture is composed of a feature selection strategy to reduce data size, an effective data segregation mechanism to handle data imbalance and a heterogeneous ensemble and a heuristic combiner mechanism to provide effective predictions. Adaptivity is incorporated by the reinforcement mechanism that retrains the model based on false predictions given by the model. The proposed APID architecture is generic; hence, it supports heterogeneous models and can also incorporate any number of machine learning models. Hence, it becomes flexible to adapt the model to data pertaining to any domain. Experiments were performed with KDD CUP 99, NSL‐KDD, and Koyoto 2006 datasets. Comparisons performed with recent works in literature indicates anomaly detection rates between 98% to 99% exhibiting the effectiveness of the proposed model.

show abstract

Machine-Learning-Based Feature Selection Techniques for Large-Scale Network Intrusion Detection

Cited by 69 publications

References 16 publications

A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors

A Feature Analysis Based Identifying Scheme Using GBDT for DDoS with Multiple Attack Vectors

A Subset Feature Elimination Mechanism for Intrusion Detection System

Real‐time anomaly detection using parallelized intrusion detection architecture for streaming data

Contact Info

Product

Resources

About